CCTV

Council owned car parks

CODE OF PRACTICE

## Contents

1 Introduction

- CCTV surveillance 3
- Legislation 3
- Systems and equipment 4
- Purpose of scheme/objectives 4
- Surveillance Camera Code of Practice 4
- Data Protection Act 5
- Changes to code 5
- Responsibilities of the owner of the scheme 5
- Management of the system 5

2 Installation

- Consultation 6
- Sound 6
- Change 6
- Dummy cameras 6

3 Accountability

- Public Information 6
- Staff 6
- Complaints 6
- Breaches of the Code 7

4 Data management

- Control and operation of the cameras 7
- Access to and security of monitors 7
- Statement of intent 7
- Evidential use of recordings 8
- Police access to data 8

5 Third party access to data

- Access/disclosure of images to third parties 8
- Freedom of Information 8
- Other rights/information 8

Appendices:

- A CCTV Car Park Inventory
- B CCTV Activity Log
- C CCTV Subject Access Request Form

1. Introduction

This Code of Practice applies to the use of the Closed Circuit Television (CCTV) systems within our Public car parks. The Town Centre CCTV system, although owned by Cheltenham Borough Council, is monitored and used proactively by Gloucestershire Police, the Data Controller, and therefore covered by their codes of practice.

This Code of Practice ensures that issues such as privacy and integrity are properly respected and the use of CCTV and Automatic Number Plate Recognition (ANPR – within Regents Arcade) in public places takes place in accordance with the advice and guidelines.

As at 1 April 2014, maintenance and upgrading work to the system has resulted in some cameras not being fully operational.

CCTV Camera Surveillance Closed Circuit Television (CCTV) cameras operated by local authorities in public car parks the prevention and detection of crime.

The operation of CCTV systems must be undertaken with due regard to the following legislation:

- The Data Protection Act 1998
- The Human Rights Act 1998
- The Regulation of Investigatory Powers Act 2000
- The Freedom of Information Act 2000
- Protection of Freedoms Act 2012
- Surveillance Camera Code of Practice
- Information Security Policy

The system is intended to view activity in public car parks and footways. It will not be used to invade the privacy of any persons in domestic, business or other private premises, buildings or land.

Description of Systems and Equipment This section gives a general description of systems and their uses, it is not exhaustive in nature, nor does it supersede or replace any legislative requirements.

Visible CCTV cameras may be securely fixed on rigid mountings at various locations (see Appendix A for locations and equipment information) cameras conform, as a minimum, to standards of performance laid down by the Secretary of State for Transport. For the avoidance of doubt, the cameras may be;

- ‘Static’ - permanently sited at a particular location
- Of ‘Analogue’ or ‘digital’ image format. • Hard-wired, networked or wireless networked.

Purpose of Scheme Closed Circuit Television (CCTV) cameras operated by local authorities in public car parks are used for the prevention and detection of crime.

Adequate signage displaying the following, or similar, wording will be installed and maintained on the camera pole or within the area of coverage stating:

“Images are being monitored and recorded for the purposes of public safety, crime prevention, and traffic enforcement. This scheme is controlled by Cheltenham Borough Council. For further information contact: 01242 262626”.

The Scheme makes specific arrangements for the provision of recordings for evidential purposes to the police.

Surveillance Camera Code of Practice 2013 The scheme aspires to comply with this code and particularly the 12 guiding principles:

01. Use of a surveillance camera system must always be for a specified purpose which is in pursuit of a legitimate aim and necessary to meet an identified pressing need.

02. The use of a surveillance camera system must take into account its effect on individuals and their privacy, with regular reviews to ensure its use remains justified.

03. There must be as much transparency in the use of a surveillance camera system as possible, including a published contact point for access to information and complaints.

04. There must be clear responsibility and accountability for all surveillance camera system activities including images and information collected, held and used.

05. Clear rules, policies and procedures must be in place before a surveillance camera system is used, and these must be communicated to all who need to comply with them.

06. No more images and information should be stored than that which is strictly required for the stated purpose of a surveillance camera system, and such images and information should be deleted once their purposes have been discharged.

07. Access to retained images and information should be restricted and there must be clearly defined rules on who can gain access and for what purpose such access is granted; the disclosure of images and information should only take place when it is necessary for such a purpose or for law enforcement purposes.

08. Surveillance camera system operators should consider any approved operational, technical and competency standards relevant to a system and its purpose and work to meet and maintain those standards.

09. Surveillance camera system images and information should be subject to appropriate security measures to safeguard against unauthorised access and use.

10. There should be effective review and audit mechanisms to ensure legal requirements, policies and standards are complied with in practice, and regular reports should be published.

11. When the use of a surveillance camera system is in pursuit of a legitimate aim, and there is a pressing need for its use, it should then be used in the most effective way to support public safety and law enforcement with the aim of processing images and information of evidential value.

12. Any information used to support a surveillance camera system which compares against a reference database for matching purposes should be accurate and kept up to date.

Data Protection Act 1998, Human Rights Act 1998, Regulation of Investigatory Powers Act 2000, Information Commissioners Office The scheme complies, and Cheltenham Borough Council is committed to ensuring it complies, with all relevant legislation and guidance.

Changes to the Code Any major changes to this Code of Practice will be approved by the Director of Environmental and Regulatory Services. This Code of Practice will be subject to review as required by the Service Manager who is authorised to make minor amendments.

Responsibilities of the Owner of the Scheme Cheltenham Borough Council, as owner, has responsibility for the compliance with the purposes and objectives of the scheme including operational guidance and the protection of the interests of the public and privacy of the individuals whose images are captured.

Management of the System The day-to-day management of the scheme, and requirements of the Code of Practice, will be undertaken by (post to be determined) or in that officer’s absence by designated staff.

All ensuing references to the (post to be determined) will be deemed to include the designated staff. Access to recordings will comply with specific guidelines and will be recorded and monitored (Appendix A – activity log)

The documentation required to run the scheme has been developed from, and is specifically linked to, the Code of Practice Guidelines. 2. Installation

Consultation The CCTV installations are carried out through consultation with interested parties and are based on evidenced need.

Sound No sound will be recorded in public places.

Change Any technological change, which will have a significant effect upon the capacity of the system, will be fully assessed in relation to the purpose and key objectives of the scheme.

Dummy Cameras No dummy cameras will be used in the scheme as they give a false sense of security and are in contravention to the DPA 1998 Code of Practice.

3. Accountability (post to be determined) with the day-to-day responsibility for the scheme will continuously monitor the operation of the scheme and the implementation of the Code of Practice.

(post to be determined) will undertake spot checks which will include the examination of records and the content of recorded data and recorded in the Activity Log (Appendix A)

Public Information The recording of people in public places will be undertaken fairly and lawfully. CCTV cameras will not be hidden and signs that they are operating will be displayed at the perimeter of the area of coverage.

Copies of the Code of Practice and complaints procedure can be found on the Councils internet site or on application in writing to Customer Relations, Cheltenham Borough Council, Municipal Offices, Promenade, Cheltenham GL50 9SA.

Staff Staff will be made aware of the Codes of Practice and their responsibilities in the implementation of the same.

Complaints The Councils complaints procedure will be the vehicle for complaints. Particulars about how to make a complaint, the name and address of the person to whom the complaint should be made are publicly available via the Councils website, in person or in writing to Customer Relations, Cheltenham Borough Council, Municipal Offices, Promenade, Cheltenham GL50 9SA. Breaches of the Code including those of security These will be dealt in line with the Council’s Information Security Policy and Procedures.

4. Data management

Control and Operation of Cameras

- Information recorded will be accurate, adequate and relevant and not exceed that necessary to fulfil the purpose of the scheme.
- Only authorised staff with responsibility for using the equipment shall have access to operating controls and access recorded in the Activity Log (Appendix B)
- Use of cameras will accord with the scheme objectives and comply with the Code of Practice.

Access to and Security of Monitors Access to view monitors, whether to operate the equipment or to view the images, is limited by the Data Protection Act 1998 to staff with that responsibility. These staff will have been trained and vetted for operations in this area.

An Activity Log (Appendix B) will record names of any persons that have been authorised by the (post to be determined) to have access to view the monitors.

Public access to the monitors shall not be allowed except by pre-arranged appointment with the manager and then only for lawful, proper and sufficient reasons. Visitors will be asked to respect the confidentiality requirements and will have to sign acknowledging this subject to a formal Subject Access Request (Appendix C)

Technical repairs, cleaning and similar tasks should be carried out in controlled circumstances and people undertaking these tasks will be recorded in the Activity Log (Appendix B)

Police visits to review data (under Section 29 Data Protection Act) will be pre-arranged and appointments made. Other visits by Police must comply with the provisions of the Code of Practice and the purpose of the visit must be approved by (post to be determined). Access will be monitored and recorded on the Activity Log (appendix B) with details with images viewed.

Statement of Intent ‘Recorded material’ will be used only for purposes defined in this Code of Practice.

- Access to recorded material will only take place as defined in this Code of Practice.
- Recorded material will only be accessed in accordance with the law, for investigation of crime and identification of a suspect or other lawful objective.
- Recording equipment will be checked regularly to ensure it is in good working order and that the time and date generator is correctly set and displayed and certified in the Activity Log (Appendix B).
- DVD’s required for evidential purposes will be separately indexed and securely stored and any copies handed to the Police will be sealed in an evidence bag. Evidential use of recordings When evidential data is downloaded onto a DVD, staff will be required to provide the Police with evidential statements for continuity purposes.

Police access to data Police may apply for access (under Section 29 Data Protection Act), in accordance with established protocols where they reasonably believe that access to specific data is necessary for the investigation and detection of particular offence or offences or for the prevention of crime.

5. Third Party Access to Data

Access to and Disclosure of Images to Third Parties Only designated staff employed by Cheltenham Borough Council will have access and be authorised to view images on the CCTV system. This is restricted to:

- (post to be determined)
- Other authorised staff
- Other persons authorised by one of the above positions in the investigation of a particular incident or event.

These staff members are only permitted access for the purposes of carrying out their Council duties.

Activity Log (Appendix B) will be completed where the above persons need to download or otherwise allow viewing by third parties.

There will normally be no disclosure of recorded images to third parties other than regulatory bodies. Requests by individual data subjects for disclosure of images relating to them will be considered in line with procedures and an application can be made through Customer Relations, Cheltenham Borough Council, Municipal Offices, Promenade, Cheltenham GL50 9SA

Freedom of Information Any request made under the Freedom of Information Act 2000 in relation to any material captured, stored or retained as a result of the use of CCTV cameras will be subject to relevant legislation.

Other Rights/Information An individual is entitled to serve a notice on the Council requiring the Council to cease processing images relating to that individual, or another person, on the basis that they are likely to be caused substantial, unwarranted damage or distress. All staff involved in operating the equipment must be able to recognise such a request from an individual.

(post to be determined) is responsible for responding to such requests. Where a staff member receives a request, they must inform (post to be determined) about this immediately.

(post to be determined) has 21 days to respond to the request, and must indicate whether they will comply with the request or not. If (post to be determined) decides that the request will not be complied with they will set out the reasons in the response.

Individual records should be kept referring to all the documents relating to the request and referenced for ease of access and audit purposes.